4 ms·

The EFF[1] mapped out the CA structure of the internet and it is easy to see it is anything but a monopoly or US-centric. [2] DNS is not used for key storage a

by mukyu 16y ago

The EFF[1] mapped out the CA structure of the internet and it is easy to see it is anything but a monopoly or US-centric. [2] DNS is not used for key storage as DNS is not authenticated. There is nothing stopping your registrar from being a CA and issuing you certificates. SSL certs are assigned to specific domain names. The CA really doesn't need to care if you are a Fooian Industries registered as a Romanian company. They are only interested in if you are the proper owner of fooian-ind.com. That your local government official knows that you are fierarul is of no value in determining if the cert someone sent me for fooian-ind.com is the correct one for fooian-ind.com. The infrastructure to support SSL is the result of a large number of smart people sitting down together and working out solutions. Chances are that any deficiencies or alternative solutions you may think of were considered or result from your lack of understanding. It is clearly arrogant to think otherwise. [1] http://www.eff.org/observatory http://www.eff.org/observatory [2] http://www.eff.org/files/colour_map_of_CAs.pdf http://www.eff.org/files/colour_map_of_CAs.pdf

fierarul 16y ago
I think I've stumbled upon that EFF link at some point, but I didn't study it very much. The CA graph they list there is nice, but it doesn't say much since many of the CAs there don't actually sell to consumers certificates, no? Looking at this PDF[1] I see on page 23 that there are about 30 root CAs that have signed more that 1000 certificates. And (from page 21) it seems to me that the providers are very much US centric. With regard to what does the SSL cert contain, I don't know much about this field, but I do know that the certificate may present and organization name and address/state/country. Hence I assume, identity also matters for some besides just domain ownership. Anyhow, I'm not claiming I've found a better solution than the smart guys sitting down and working out solutions, but I do find annoying that the solution they found is so expensive for commoners. As an armchair discussion, I still think that certificate info seems best to belong into a DNS record. DNSSEC perhaps could help with this? 1. https://www.eff.org/files/DefconSSLiverse.pdf https://www.eff.org/files/DefconSSLiverse.pdf

by mukyu 16y ago

fierarul 16y ago

I think I've stumbled upon that EFF link at some point, but I didn't study it very much. The CA graph they list there is nice, but it doesn't say much since many of the CAs there don't actually sell to consumers certificates, no? Looking at this PDF[1] I see on page 23 that there are about 30 root CAs that have signed more that 1000 certificates. And (from page 21) it seems to me that the providers are very much US centric. With regard to what does the SSL cert contain, I don't know much about this field, but I do know that the certificate may present and organization name and address/state/country. Hence I assume, identity also matters for some besides just domain ownership. Anyhow, I'm not claiming I've found a better solution than the smart guys sitting down and working out solutions, but I do find annoying that the solution they found is so expensive for commoners. As an armchair discussion, I still think that certificate info seems best to belong into a DNS record. DNSSEC perhaps could help with this? 1. https://www.eff.org/files/DefconSSLiverse.pdf https://www.eff.org/files/DefconSSLiverse.pdf